Overview

overview

10

Static

static

10

JaffaCakes...3e.exe

windows7-x64

10

JaffaCakes...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_46885c1de98164ecc0a5f1d4d3a9d33e

  • Size

    105KB

  • Sample

    250128-eaj7pswlht

  • MD5

    46885c1de98164ecc0a5f1d4d3a9d33e

  • SHA1

    bc8095453d956cf29d1ca1c4c7005979f5bceec2

  • SHA256

    ca8d0ebd11a464fbff420f6c65ab13c4bb96c6f7825179981e4b08a116f56463

  • SHA512

    0e5191a1a2baad58325fd79c5e645e047b2109944323f9917d0a75b0f0674474383999bce82a9036152b200b8eaaba5c8a71584c24ea8ea807bb9ce4509cfb3e

  • SSDEEP

    3072:n7TVJjxtPeWmS7PbHSjzT9yYxtMBU8rw0FsxXMksJ2m5:nXVJjxtPLmkPbHSjzomMWyw0GxXfsYc

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_46885c1de98164ecc0a5f1d4d3a9d33e

    • Size

      105KB

    • MD5

      46885c1de98164ecc0a5f1d4d3a9d33e

    • SHA1

      bc8095453d956cf29d1ca1c4c7005979f5bceec2

    • SHA256

      ca8d0ebd11a464fbff420f6c65ab13c4bb96c6f7825179981e4b08a116f56463

    • SHA512

      0e5191a1a2baad58325fd79c5e645e047b2109944323f9917d0a75b0f0674474383999bce82a9036152b200b8eaaba5c8a71584c24ea8ea807bb9ce4509cfb3e

    • SSDEEP

      3072:n7TVJjxtPeWmS7PbHSjzT9yYxtMBU8rw0FsxXMksJ2m5:nXVJjxtPLmkPbHSjzomMWyw0GxXfsYc

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks